It should cache for an hour, I think (based on a quick look at nodebb package manager code). So yes - you have to wait a bit before the nbbpm refreshes. You can just install the updated version manually by using npm install <package name> from the command line in NodeBB folder.
Dealing with unverified users in the ACP
-
I think Latest Users means, or should mean, the same thing as Verified Users. In other words, if an account has not been verified, it's never listed under Latest Users.
Along those lines, an option that will allow the admin to enable auto-purging (auto-deleting) user accounts that have not been verified after X number of days would be nice, too.